ftrout
- 17 skills
- 0 followers
- 6 hours ago last updated
- ▌ Incident Report Writing · ftrout bundleWrite incident communications for the right audience: executive summaries, technical post-incident reports, status updates on a cadence during a live incident, customer and partner notification drafts, regulatory notification checklists (GDPR, SEC 8-K, HIPAA, NIS2, DORA, state laws), and blameless lessons-learned documents, with a normalized UTC timeline built from raw events. Use this whenever someone asks to "write up the incident", "send an update", "brief the exec", "draft the customer notice", "do we have to notify", "build the timeline", "PIR", "post mortem", "retro", or pastes triage notes, chat logs, or a list of timestamps and asks what to tell people. Also reach for it when an incident is being closed and nothing has been written yet.
- ▌ Cloud Incident Investigation · ftrout bundleInvestigate suspected compromise in AWS, Azure, or GCP: find the right logs (CloudTrail, AzureActivity, Entra audit, GCP Cloud Audit Logs), reconstruct what an identity or access key did, spot the high-signal control-plane events (access key creation, role assumption chains, StopLogging, PutBucketPolicy, role assignments, Key Vault reads, setIamPolicy, service account key creation), size the blast radius, and contain safely (rotate, deny, SCP, revoke) while preserving evidence. Use it whenever someone mentions a leaked or exposed access key, a GuardDuty / Defender for Cloud / Security Command Center finding, an unexpected cloud bill, a public bucket, an unknown IAM user or role, "someone logged into the console", "who created this resource", or pastes CloudTrail, Activity Log, or audit log JSON, even if they do not say "incident". Also use it for post-hoc "what did this credential touch" reviews.
- ▌ Identity Threat Investigation · ftrout bundleInvestigate a suspected account or identity compromise in Entra ID (Azure AD), Okta, Google Workspace, or on-prem Active Directory: analyze sign-in logs for impossible travel, new country or ASN, MFA fatigue, legacy auth, token replay and AiTM session hijack; check risky OAuth consent grants, MFA method changes, mailbox rules, and privilege changes; spot AD attack indicators (Kerberoasting, AS-REP roasting, DCSync, golden and silver tickets, NTDS theft); and contain in the right order (reset, revoke sessions, disable, remove consent, krbtgt double reset) without breaking the business. Use it whenever someone says a user "got phished", "clicked the link", "approved an MFA prompt they didn't request", reports a risky sign-in or Identity Protection / Okta ThreatInsight alert, asks "is this account compromised", pastes sign-in or Security event log exports, or mentions a suspicious inbox rule, unknown app consent, or new Global Admin, even if the word "identity" never appears.
- ▌ Log Forensics · ftrout bundleInvestigate an incident from logs: pick the Windows Security/System/PowerShell/Sysmon event IDs, Linux auth/audit/systemd/cron/shell-history artifacts, and web server or proxy logs that answer the question, normalize time zones, merge everything into one UTC super-timeline, pivot user to host to process to network, and preserve evidence properly. Use it whenever someone pastes or points at exported logs (CSV, JSON, EVTX exports, auth.log, access.log), asks "what happened on this host", "when did they get in", "what did this account do", "build a timeline", "which event IDs should I pull", or needs a forensic narrative for an incident report, even if they never say forensics.
- ▌ Ioc Extraction · ftrout bundleExtract, normalize, defang/refang, classify, and de-duplicate indicators of compromise (IPs, domains, URLs, hashes, emails, file paths, registry keys, CVEs, wallet addresses) from any unstructured text such as threat intel reports, vendor advisories, phishing emails, pasted logs, PDFs, or chat messages, then produce a clean, machine-readable indicator list with context and an enrichment plan. Use this whenever the user pastes or points at a report, advisory, email, or blob of text and wants the indicators out of it, asks to "pull the IOCs", "defang these", "make a blocklist", "turn this into a watchlist", "what should we block from this report", or needs indicators formatted for a SIEM, EDR, firewall, TIP, or STIX bundle. Also use it when someone asks whether a list of indicators is well-formed or contains noise.
- ▌ Malware Triage · ftrout bundleSafe static triage of a suspicious file, hash, or sandbox report without ever executing it: hash lookups, file type by magic, entropy and packing indicators, PE/ELF/LNK/PDF/Office/archive metadata, interesting strings and IOCs, sandbox report interpretation (Tria.ge, ANY.RUN, VMRay, Hybrid Analysis, CAPE, Joe), capability and MITRE ATT&CK assessment, YARA rule drafting, and hand-off to detection and incident work. Use it whenever someone asks "what is this file", "is this hash bad", "can you look at this sample / attachment / binary / script / DLL / LNK / ISO", pastes a VirusTotal or sandbox result, wants a YARA rule, or an EDR alert names an unknown executable, even if they never say the word malware.
- ▌ Threat Hunting · ftrout bundlePlan, run, and write up hypothesis-driven threat hunts (PEAK / TaHiTI style): turn a threat report, an ATT&CK technique, a coverage gap, an anomaly, or "something feels off" into a testable hypothesis with data sources, queries, expected benign volume, an analysis technique (stacking, prevalence, baselining, clustering, sequencing, outliers), success criteria, and hand-offs. Use it whenever someone says "hunt for", "go look for", "is anyone doing X in our environment", "what should we hunt this week", "build a hunt from this report", "stack these values", "what is rare here", "baseline this data source", or hands over a CSV/JSONL export and asks what stands out. Also use it when a report or a purple-team result implies behaviour that no alert covers, even if nobody says the word hunt.
- ▌ Incident Triage · ftrout bundleTriage a security alert or suspicious event the way a tier-1/tier-2 SOC analyst does: decide whether it is a true positive, benign, or a false positive, scope it, assign a defensible severity tier, and write a triage note with evidence for and against, actions taken, and next steps. Use this whenever the user pastes an alert, a SIEM/EDR/IdP/email/cloud/DLP detection, a scanner finding, or a "user reported something weird" message and asks "is this bad", "what do I do with this", "how severe is this", "should I escalate", "write up this alert", or "triage this". Also use it when someone wants a consistent severity score, a benign-explanation checklist, or the questions to ask before escalating, even if they never say the word triage.
- ▌ Phishing Analysis · ftrout bundleAnalyze a reported or suspicious email end to end: Received chain and SPF/DKIM/DMARC alignment, sender and Reply-To and display-name mismatches, lookalike domains, URL and redirector analysis, QR codes, HTML smuggling, attachment triage, lure classification (BEC/invoice, credential harvest, callback/TOAD, MFA push, package delivery, HR/payroll), verdict, blast radius, and response actions. Use it whenever someone pastes headers or an .eml, says "is this phishing", "a user reported this email", "check these headers", "is this sender legit", "who else got this", asks why DMARC failed, wants a phishing triage note, or forwards a suspicious invoice, voicemail, DocuSign, MFA, delivery, or payroll-change message, even if they never use the word phishing.
- ▌ Skill Template · ftrout bundleReplace this with what the skill does AND when to use it. List the phrases, artifacts, and situations that should trigger it, including cases where the user does not name the task explicitly. Keep under 1024 characters. Be a little pushy; Claude under-triggers skills.
- ▌ Mitre Attack Mapping · ftrout bundleMap observed adversary behaviour to MITRE ATT&CK tactics, techniques and sub-techniques with evidence, rationale, and confidence, then produce a mapping table and an ATT&CK Navigator layer JSON. Use it whenever someone asks "what ATT&CK techniques is this", "map this to ATT&CK", "tag this with TTPs", "build a Navigator layer / heat map", "which techniques does our detection coverage miss", or pastes an incident timeline, threat report, sandbox report, Sigma rule set, or purple-team results and wants them expressed in ATT&CK terms. Also use it to check an existing mapping for over-mapping, wrong tactics, or stale technique IDs, and to diff a threat-profile layer against a detection-coverage layer.
- ▌ Purple Team Exercise · ftrout bundlePlan and run a purple-team detection-validation exercise: a controlled, cooperative test of whether your telemetry and detections would see a chosen set of adversary behaviors, not an attack. Use it to turn a threat profile or an incident into scenarios, pick ATT&CK techniques, map each to public adversary-emulation content by name or ID (Atomic Red Team, MITRE CALDERA, Stratus Red Team, MITRE ATT&CK Evaluations emulation plans), write rules of engagement and a safety and comms plan, define expected telemetry per technique, score each as alerted / logged-only / not-visible, measure time-to-detect, and convert the gaps into a detection backlog. Reach for it when someone says "purple team", "detection validation", "adversary emulation", "run some atomics", "test our detections", "MITRE coverage assessment", "are we detecting X", "validate the SOC", or asks to build a scorecard or an exercise plan. This skill contains no attack commands and never runs the tests; it plans, coordinates, and scores.
- ▌ Siem Query Authoring · ftrout bundleTurn an investigative question, a hunt hypothesis, or an indicator list into a correct, efficient query for the team's SIEM: Microsoft Sentinel / Defender XDR (KQL), Splunk (SPL with CIM), Elastic (KQL, EQL, ES|QL over ECS), Google SecOps / Chronicle (UDM search, YARA-L), or Athena / BigQuery SQL over CloudTrail, VPC flow and audit logs. Use it whenever someone asks to "write a query", "search the SIEM for", "check if any host talked to", "find logons from", "translate this SPL to KQL", "why does my query return nothing / time out", or hands over an IOC list (typically the CSV from `ioc-extraction`) that needs to become a retro-hunt. Also use it when another skill needs a query run: backtests for `detection-engineering`, hunt queries for `threat-hunting`, scoping for `incident-triage`.
- ▌ Soar Playbook Design · ftrout bundleDesign safe security automation playbooks for a SOAR platform (Microsoft Sentinel automation rules and Logic Apps, Splunk SOAR, Cortex XSOAR, Tines, Shuffle): triggers, enrichment, decision logic, containment behind human-approval gates, idempotency, rate limits, rollback, error handling, dry-run testing, and metrics, expressed in a vendor-agnostic JSON definition that a bundled linter checks. Use this whenever someone wants to "automate" an alert response, asks for a playbook, workflow, automation rule, Logic App, story, or runbook-as-code, wants to auto-block, auto-isolate, auto-disable, or auto-close anything, asks "is this automation safe", or wants an existing playbook reviewed or translated between platforms. Design and review only; it never executes actions.
- ▌ Vulnerability Triage · ftrout bundlePrioritise vulnerabilities and produce a ranked remediation plan using CVSS v3.1/v4.0, EPSS, CISA KEV, exploit maturity, asset exposure and criticality, compensating controls, and business context, with tiers (P1..P4), SLAs, risk statements, and asset-owner communications. Use it whenever someone shares a scanner export, a CVE list, a vendor advisory, a "should we patch this now" question, a KEV notification, or a Patch Tuesday summary and wants to know what to fix first, how urgent a specific CVE is for their environment, what to do when a system cannot be patched, how to write a risk acceptance or exception, or how to explain a vulnerability decision to an asset owner or executive. Also use it to tune a scoring model or SLA policy.
- ▌ Detection Engineering · ftrout bundleDesign, write, test, tune, deploy, and review detection rules through their full lifecycle, with Sigma as the canonical rule format and conversion to Splunk SPL, Sentinel/Defender KQL, Elastic EQL/ES|QL, or Chronicle YARA-L. Use it whenever someone wants to "write a detection", "build a rule for", "alert on", "turn this report/hunt/purple-team gap into a detection", "review this Sigma rule", "why is this rule so noisy", "tune the false positives", "map this rule to ATT&CK", or pastes a Sigma/KQL/SPL rule and asks whether it is any good. Also use it when a threat report, an incident lesson, or a hunt result implies a detection that nobody has written yet, even if the user only asks "how would we catch this next time".
- ▌ Threat Intel Analysis · ftrout bundleTurn raw threat intelligence (vendor reports, ISAC bulletins, CISA/CERT advisories, STIX bundles, MISP events, social-media threads, leak-site posts, dark-web chatter) into actionable products: extract TTPs and indicators, grade the source with the Admiralty code, assess relevance against the organisation's threat profile and PIRs, apply the Diamond Model, and write flash alerts, actor profiles, and weekly digests with TLP markings plus concrete detection and hunt asks. Use it whenever someone pastes or links a threat report and asks "is this relevant to us", "what should we do about this", "summarise this for the SOC / leadership", "write up this actor", "what is in this STIX bundle", "build our threat profile", "draft this week's intel digest", or wants to know whether an intel claim is credible.